fix: prevent secondary protocols from overwriting primary server configuration data

inc/InstallProtocolManager.php

@@ -1517,6 +1517,10 @@ class InstallProtocolManager
                     }
                 }
 
+                $existingProtocol = $server->getData()['install_protocol'] ?? '';
+                $currentSlug = $protocol['slug'] ?? '';
+                $isFirstProtocol = ($existingProtocol === '' || $existingProtocol === $currentSlug);
+                if ($isFirstProtocol) {
                     self::markServerActive($serverId, null, [
                         'vpn_port' => $resolvedPort,
                         'server_public_key' => $res['server_public_key'] ?? null,
@@ -1524,6 +1528,10 @@ class InstallProtocolManager
                         'container_name' => $res['container_name'] ?? null,
                         'awg_params' => $resolvedAwgParams,
                     ]);
+                } else {
+                    // Secondary protocol — just mark active, don't overwrite primary data
+                    self::markServerActive($serverId, null, []);
+                }
 
                 $pdo = DB::conn();
                 $pid = self::resolveProtocolId($protocol);
@@ -1653,10 +1661,16 @@ class InstallProtocolManager
                 $stmt2 = $pdo->prepare('INSERT INTO server_protocols (server_id, protocol_id, config_data, applied_at, created_at) VALUES (?, ?, ?, NOW(), NOW()) ON DUPLICATE KEY UPDATE config_data = VALUES(config_data), applied_at = NOW()');
                 $stmt2->execute([$serverId, $pid, json_encode($config)]);
             }
-            // Save vpn_port to vpn_servers table for shell protocols (like AIVPN)
+            // Save vpn_port to vpn_servers table ONLY for the primary (first) protocol
+            // Secondary protocols store their ports in server_protocols.config_data only
             if ($port !== null && $port > 0) {
+                $existingProtocol = $server->getData()['install_protocol'] ?? '';
+                $currentSlug = $protocol['slug'] ?? '';
+                $isFirstProtocol = ($existingProtocol === '' || $existingProtocol === $currentSlug);
+                if ($isFirstProtocol) {
                     self::markServerActive($serverId, null, ['vpn_port' => $port]);
                 }
+            }
             return $res;
         } catch (Throwable $e) {
             $message = (string) $e->getMessage();